@rackbops/ac-plugin-contract 2.0.0-alpha.45 → 2.0.0-alpha.47

package/AUTHORING.md

@@ -821,6 +821,13 @@ is granted. `hello`'s own manifest declares `agent.git.read` as the reference de
 never actually calls it -- the declaration alone is what the grid, a live pairing pass, and this
 guide need).
 
+A grant outlives its declaration (#645): disabling a plugin, removing it, or dropping a capability from its
+manifest does not revoke what an operator already granted, and does not block editing the other grants on that
+machine. The stale pair has no row in the grid (only declared capabilities have one), the host keeps it as it
+is, and re-enabling the plugin or restoring the capability brings the row, ticked, back. What the host will
+not do is let anyone *add* a grant for a capability no loaded plugin declares. A stale pair has no checkbox
+to untick; to revoke one, `PUT /api/agents/:id/grants` the machine's grant map without it.
+
 At runtime, call a granted capability on a specific paired machine through `host.agent`:
 
 ```ts
@@ -1071,8 +1078,9 @@ host-side reader at all -- validates, but nothing consumes it. **`provides`/`con
 guide's worked example: a slot (`issues@1`, `artifacts@1`, `auth@1`, `notify@1`) is a
 named/versioned TypeScript interface one plugin **provides** and others **consume** -- the host
 refuses to activate a consumer whose slot has no provider, and says why (`resolveSlots`,
-`packages/host/src/plugins/slots.ts`, re-exported from `plugins/index.ts`). `ac-auth-cf-access`
-(`auth@1`) and `ac-notify-discord` (`notify@1`) are the reference *providers*; see their own
+`packages/host/src/plugins/slots.ts`, re-exported from `plugins/index.ts`). `ac-auth-cf-access` and
+`ac-auth-usr` (`auth@1`, alternatives: a slot has one provider) and `ac-notify-discord` (`notify@1`) are
+the reference *providers*; see their own
 `src/server.ts` for `host.slots.provide(slot, version, impl)`, and `design.md` §4 for the slot
 contract itself. The consumer half is `host.slots.resolve<T>(slot, version)` (#97): the provider
 bound for a slot, or `null` when none is. It throws unless the plugin's own manifest lists the exact

package/dist/slots.d.ts

@@ -175,6 +175,10 @@ export interface Identity {
      *  person. The host admits a machine identity on `GET`/`HEAD /api/readyz` only and refuses it on every other gated
      *  route; any other value is treated as a non-person too (#552). */
     kind?: "user" | "machine";
+    /** The roles the identity holds in THIS app, with the app's role prefix stripped (a usr token's
+     *  `"ac:admin"` is `"admin"`; roles for other apps are not listed). Absent when the provider does not
+     *  model roles (Cloudflare Access does not); an empty array is an identity that holds none (#102). */
+    roles?: string[];
 }
 /** `auth@1`: resolve the identity for a request, or null in open mode. */
 export interface AuthProvider {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rackbops/ac-plugin-contract",
-  "version": "2.0.0-alpha.45",
+  "version": "2.0.0-alpha.47",
   "private": false,
   "type": "module",
   "description": "The artifact-console plugin ABI for out-of-repo plugin authors: HostApi, the acPlugin manifest contribution points, the generated manifest JSON Schema, and the @ac/host ambient browser declaration.",
@@ -35,9 +35,9 @@
   },
   "devDependencies": {
     "@ac/contract": "0.0.0",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "typescript": "^7.0.0",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   },
   "scripts": {
     "build": "node build.mjs",